Sandbox assessment criteria indicators o 
ICO. 


Information Commissioner's Office 


Please note: these criteria will be assessed via the full application form, which will be provided to applicants following 
an engagement call with the Sandbox team. 


Indicators 


Innovation 


1 


Product or service is clearly a 
reworking of an existing 
approach. 


Limited or no comparison 
with other approaches to 
show how they are 


2 


Information provided shows 
that there is likely to be some 
form of innovation being 
undertaken. 


Some form of comparison with 
existing approaches is made 


3 


The innovation present is 
clear to the reader with use 
of effective qualitative and 
quantitative evidence. 


Comparisons with existing 
approaches are specific, 


4 


The innovation present is clear 
and likely to be transformative 
as shown through effective 
qualitative and quantitative 
evidence. 


Comparisons with existing 


innovative. that shows the difference and relevant, and well- approaches are specific, 
innovation. evidenced. relevant, and well-evidenced. 
Public Benefit | Product or service will clearly | Product or service is likely to The breadth and depth of The breadth and/or depth of 


not benefit the public 
beyond the organisational 
benefit of the submitting 
organisation. 


Limited or no attempt to 
quantify the breadth or 
depth of benefit to the 
public of the product or 
service. 


bring some benefit to the public 
beyond the benefit of the 
submitting organisation. 


A reasonable attempt is made 
to quantify potential public 
benefit in terms of breadth and 
depth and supported with some 
quantitative and/or qualitative 
evidence 


potential public benefit 
created by the product or 
service is clear and 
significant. 


Effective qualitative and 
quantitative evidence is 
provided to support the 
application. 


public benefit present is clear 
and likely to be substantive and 
transformative. 


Compelling qualitative and 
quantitative evidence is 
provided. 


Indicators 


Sandbox plan 
viability 


Sandbox activity and 
mechanisms proposed do 
not look like they fall within 
the scope of our suggested 
approach. 


The proposed timescales 
would not fit with proposed 
scope and resource 
requirements of the project 


The organisation does not 
appear to have a plan to 
identify or assess risks 
robustly or have sufficiently 
mitigated any of the risks 
they raise. The risks to both 
project delivery and to the 
data subject have not been 
assessed. 


Exit plan has clear 
deficiencies and/or does not 
adequately mitigate risks or 
provide redress. 


Mechanisms proposed clearly 
fall within the scope of the 
intended approach. 


With some slight revision 
proposed timescales will fit 
proposed scope and resource 
requirements of the project 


There is a plan to identify and 
assess risk and where risks 
already identified there are 
clear mitigations and control 
mechanisms in place that 
appear efficient and effective. 


There is a clear exit plan in place 
that attempts to mitigate risk to 
participants and provide redress 
where needed. 


Mechanisms have been well 
thought through, relate to 
the intended scope with 
clear relation to timescales 
and resources likely to be 
needed. 


Some risks have been 
identified and assessed. 
There are risk mitigations 
and control mechanisms in 
place that appear efficient 
and effective. The risks to 
both to the data subject and 
to project delivery are both 
well understood. 


There is a clear exit plan that 
evidences how risks will be 
mitigated and any redress 
needed will be provided. 


Mechanisms have been well 
thought through, relate to the 
intended scope with clear 
relation to timescales and 
resources likely to be needed. 


There are sophisticated risk 
mitigations and control 
mechanisms in place that have 
been shown to be efficient and 
effective through the provision 
of evidence. The risks to both to 
the data subject and to project 
delivery are both well 
understood and have been 
mitigated to ensure delivery of 
the sandbox plan. 


There is a clear exit plan that 
evidences how risks will be 
mitigated, how any redress 
needed will be provided, and in 
effect ensure a ‘failsafe’ 
approach. 


